Security violations on a computer systems can be categorized as being either intentional or accidental. Among the forms of intentional access are unauthorized reading of data, unauthorized modification of data, and unauthorized destruction of data. Most operating systems provide a means for processes to spawn other processes. In such an environment, it is possible to create a situation where operating-system resources and user files are misused. Worms and viruses are two common methods of misuse. The protection of a computer system depends on its ability to identify the source of the programs that are to be executed and to verify that these programs have not been modified in a way such that then may pose a security threat to the system.
In addition to verifying the authenticity of the source of a program, there is also a need to ensure that the files, memory segments, CPU, and other resources of a computer system can be utilized only by those processes that have gained proper authorization from the operating system. There are several reasons for providing this protection. The most obvious is the need to prevent mischievous, intentional violation of an access restriction. Of more general importance is the need to ensure that each program component active in a system uses system resources in ways consistent with the stated policies for the uses of these resources. Protection can improve the reliability by detecting latent errors at the interfaces between component subsystems. Early detection of interface errors can prevent contamination of a healthy subsystem by another subsystem that is malfunctioning.
A process typically operates within a protection domain. The domain specifies the resources that the process may access. Each domain defines a set of objects and the types of operations that may be invoked on each object. The ability to execute an operation on an object is an access right. A domain is a collection of access rights, each of which is typically an ordered pair: &lt;object-name, rights-set&gt;. For example, if domain D has the access right &lt;file F, {read, write}&gt;, then a process executing in domain D can both read and write file F. It should not, however, be allowed to perform any other operation on that object. Domains may be disjoint or they may share access rights. The association between a process and a domain may also be either static of dynamic. Thus, it is important to restrict the protection domains accessible to each process.
Thus, what is needed is an apparatus and method for providing an forgeable signature of an executable image that can be used to identify the origin of the executable image, whether there has been any modification to the executable, and the level of access rights or trust the executable should be allowed by the operating system.